Kaspersky’s GReAT team has published research attributing an ongoing cyberespionage campaign against government and critical-sector networks in Central Asia and Syria to a suspected Chinese-speaking threat actor. The operation, active since at least January 2025, is built around two previously undocumented, memory-resident backdoors — OctLurk and SilkLurk — supported by a custom traffic-proxying utility, LurkProxy. Researchers assess with medium confidence that a single operator runs both backdoors: several victims were infected with both families, in some cases from the same staging directory.

What happened

Targets span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, concentrated in ministries of foreign affairs, law enforcement, healthcare, research institutions, urban planning and facilities management, logistics, and public education. The breadth of sectors and the long dwell time — over a year of sustained access before public disclosure — points to a patient, intelligence-gathering operation rather than a smash-and-grab intrusion.

The initial access vector has not been confirmed. Once a foothold is established, the attackers use stolen administrator credentials, scheduled tasks, and malicious Windows services to expand and maintain access across the network, alongside the two custom backdoors.

Technical details

  • OctLurk: injected directly into memory via a loader. The loader drops an encrypted payload into a hard-coded directory and installs a persistent service (observed as RmSs) that repeatedly relaunches a legitimate binary alongside the loader — a classic DLL-search-order-adjacent persistence trick that blends into normal service activity. Once running, OctLurk gathers system information, encrypts it, and exfiltrates it over a raw stream-socket connection to a hard-coded C2 address. It supports in-memory plugin loading for command execution, file operations, clipboard read/write, screenshot capture, and synthetic mouse input.
  • SilkLurk: launched via a DLL side-loading sequence — a legitimate, signed executable is used to load a malicious DLL placed alongside it, a technique that routinely evades signature-based defenses since the parent process is trusted. SilkLurk opens a TCP socket to a configured C2 server, reports victim/system details, and accepts commands to query local time, adjust its sleep/beacon interval, update its own backdoor configuration, and receive and inject additional plugins.
  • LurkProxy: a dedicated network-proxying tool used to relay C2 traffic through compromised internal hosts, letting the operator reach segmented parts of a target network without giving every implant direct outbound access — reducing the number of hosts that need to touch external infrastructure and complicating network-based detection.
  • Attribution: Kaspersky assesses the actor is Chinese-speaking with medium confidence based on tooling and tradecraft overlaps, but has not tied the campaign to a previously tracked group.

Impact

This is a textbook long-haul espionage operation against government infrastructure in a region with limited public threat-intel coverage. Because both backdoors are memory-resident and paired with side-loading and service-based persistence, they are built to survive reboots and evade endpoint tooling that relies on static signatures or on-disk artifacts alone. Organizations across the affected sectors — especially ministries of foreign affairs, law enforcement, and critical-facilities management — should treat this as an active, ongoing threat rather than a closed incident: the campaign was still running at time of disclosure, and the initial access vector remains unidentified, meaning the intrusion path is still open at unpatched or uncompromised-looking hosts.

Mitigation

  • Hunt for the RmSs service name and unusual services that relaunch alongside otherwise-legitimate binaries; treat any newly created Windows service tied to an infrequently-updated executable as suspicious pending investigation.
  • Audit DLL search-order and side-loading exposure for signed binaries deployed in your environment, particularly on servers in government, healthcare, and facilities-management networks — a writable directory next to a trusted signed EXE is the precondition SilkLurk depends on.
  • Monitor for raw socket C2 patterns: both backdoors use direct stream/TCP sockets to hard-coded or configured servers rather than HTTP(S)-based C2, so network egress monitoring tuned only for web-based beaconing will miss them. Baseline and alert on unexpected outbound TCP connections from server and workstation subnets.
  • Rotate and tightly scope administrator credentials. The attackers lean on stolen admin credentials for lateral movement — enforce credential hygiene, disable unused privileged accounts, and monitor for anomalous use of admin credentials outside normal administrative workflows.
  • Segment internal proxying paths. LurkProxy’s role is to relay traffic through already-compromised hosts — restrict which hosts can route traffic to sensitive network segments and flag internal hosts unexpectedly acting as relays.

Full indicators of compromise, YARA rules, and a complete technical breakdown are available in Kaspersky’s Securelist writeup; organizations in the affected regions and sectors should treat any host displaying either backdoor’s persistence pattern as compromised and begin incident response immediately.